Prime Minister Shehbaz Sharif has expressed fresh resolve to eradicate polio from Pakistan during a meeting with a delegation of the Gates Foundation.
According to details that surfaced on Wednesday, the prime…

Prime Minister Shehbaz Sharif has expressed fresh resolve to eradicate polio from Pakistan during a meeting with a delegation of the Gates Foundation.
According to details that surfaced on Wednesday, the prime…

Few-shot class-incremental learning remains a significant hurdle in artificial intelligence, demanding systems learn new concepts from minimal data without forgetting previously acquired knowledge. Shuai Huang, Xuhan Lin, and Yuwu Lu from the…

Display
Built with UL-verified phytoplankton bio-resin materials, the world-first display delivers ultra-low-power performance and remote management via Samsung E-Paper App and Samsung VXT
Continue Reading

In today’s rapidly evolving artificial intelligence environment, organizations are increasingly relying on third-party application programming interfaces from platforms like OpenAI, Google and Amazon Web Services to embed advanced features into their products. These APIs offer significant benefits, particularly in terms of time and cost savings, by enabling companies to leverage existing technology rather than building solutions from scratch.
While this approach can speed up deployment and reduce the burden of managing complex infrastructure, it also raises key legal and privacy issues — like how data flows are controlled, who is responsible for data security, and how licensing restrictions are enforced. The situation becomes even more challenging when the procuring organization opts to use its own API keys instead of those provided by the AI feature developer.
When developers leverage third‑party AI APIs to build and deliver their own AI features, they often do so using their own licensed API keys to access those services. Prompts — for example, data queries, order‑processing commands, or report generation instructions — are sent from the procuring organization’s systems to the developer’s platform and then forwarded to the API provider. The provider applies its AI models and returns outputs, which the developer delivers to the procuring organization.
In this process, the developer assumes the role of the data controller because it determines the purpose and means of processing: it decides which prompts to collect, how to combine or enrich them, including developer-supplied templates, and how outputs are used and delivered. As controller, the developer must ensure lawful processing, provide transparency and implement appropriate technical and organizational measures — such as encryption, access controls, logging and regular audits — to protect personal data throughout the life cycle in line with the EU General Data Protection Regulation.
If there is sensitive data involved — such as personal data under the GDPR or personal health information under the Health Insurance Portability and Accountability Act — the developer, who has control over its API keys, can apply appropriate privacy-enhancing technologies before transmitting. These include measures like anonymization, pseudonymization, zero data retention endpoints, and in-flight filtering, to prevent identification and reduce risk, thereby supporting compliance with applicable data protection laws.
Once the developer submits prompt data to the API provider, the provider acts as a data processor and is responsible for processing data only in accordance with the developer’s documented instructions. To ensure proper governance, the parties should establish a written agreement — such as a data processing agreement that clearly outlines the scope and lawful purposes of processing, as well as the provider’s obligations regarding data retention and deletion.
The agreement should also require the provider to maintain records of processing activities, cooperate with audits, assist the developer with data subject requests and breach notifications, and implement appropriate safeguards — including encryption, access controls, logging, and incident detection/response — all in compliance with GDPR requirements.
As organizations increasingly use AI internally — whether embedding off‑the‑shelf features or developing bespoke capabilities — there is a good chance they already hold API licenses for major platforms such as OpenAI or Azure.
As such, it is increasingly common for procuring organizations to ask that the AI feature developer use the organization’s own API keys to access the feature. This gives the procuring organization more direct control over the data, use and costs associated with the API. However, this shift significantly impacts the role and control of the AI feature developer.
When the procuring organization uses its own API keys to access a developer AI feature, responsibility for transmitting, storing and controlling access to the data mostly shifts to them. This means the developer no longer has full visibility into how the data is handled once it leaves their infrastructure. As a result, it becomes much harder for the developer to verify if safeguards — like encryption, access controls or quick data deletion — are properly in place, or to enforce policies that prevent misuse or breaches.
Because of this, it’s crucial to have clear, well-structured contracts between the developer and the organization. These should lay out who’s responsible for what — covering data security, liability and compliance — and reflect the actual level of control each party has over the data and the API.
Effectively managing third‑party AI integrations requires balancing the benefits of rapid deployment and cost savings with the obligation to address privacy and data protection exposures.
Whether data flows go through company‑controlled APIs or customer‑managed keys, robust data‑governance frameworks ensure risks are equitably allocated and information is safeguarded in line with applicable jurisdictional requirements and the sensitivity of the data involved.
Ultimately, clear contractual responsibilities, active oversight and strong governance are essential when deploying AI features via third‑party APIs, especially as organizations increasingly want to use and control access to the AI capabilities they procure.
Rachel Webber, AIGP, CIPP/E, CIPP/US, CIPM, CIPT, FIP, is senior counsel for a software as a service and AI organization.

New evidence showed that mental health outcomes were significantly worse in people with atherosclerotic cardiovascular disease (ASCVD) and elevated 10‑year ASCVD risk scores, linking heart disease risk with psychological distress in a large…
ISLAMABAD: Pakistan has imposed strict health screening measures at all international entry points after two cases of the deadly Nipah virus were confirmed in India’s West Bengal, amid growing regional concern over the highly fatal infection.

MELBOURNE, Australia — Vera Zvonareva and Ena Shibahara defeated Australian favorites Talia Gibson and Kimberly Birrell Wednesday evening, and now the doubles semifinals are set.
Here’s a closer look at the WTA Tour…
1. Refinements to Solvency II – Third-Country Insurance Branches
PRA Proposal of Further Refinements to Solvency II Regarding Third-Country Insurance Branches (CP20/25)
Following Brexit, the UK Government has worked with the Prudential Regulation Authority (PRA) and Financial Conduct Authority (FCA) to implement Solvency II into the UK’s financial services regulatory framework. Implementation of the amended regime (Solvency UK) was largely completed in December 2024, although the PRA and FCA continue to implement amendments as necessary.
From September to December 2025, the PRA consulted on proposed changes to the treatment of third-country insurance branches.
The primary change proposed is the increase of the subsidiarisation threshold from £500m to £600m in liabilities covered by the Financial Services Compensation Scheme. The PRA believes that inflation has artificially caused some branches to reach the liability threshold and therefore unnecessarily become UK subsidiaries.
In addition, third-country branches are required to notify the PRA in the event they anticipate reaching the subsidiarisation threshold within three years.
The PRA also confirmed a series of minor PRA Rulebook amendments, namely:
2. Solvency II Reporting and Disclosure: Post-implementation Amendments
PRA Consultation on UK Solvency II Reporting and Disclosure: Post-implementation Amendments (CP22/25)
As part of the continued review of Solvency UK, the PRA has opened consultation on amendments to the reporting and disclosure requirements under the regime.
Key proposals:
Consultation closes on March 4, 2026. The implementation date of any resulting changes is anticipated to be on or after December 31, 2026.
3. UK Berne Financial Services Agreement Guidelines
PRA/FCA Guidelines on the UK Berne Financial Services Agreement (BFSA)
In November 2025, the PRA and FCA jointly published guidelines for providing services under the BFSA.
UK Insurance Firms
Eligible UK insurance firms must notify the Swiss Financial Market Supervisory Authority (FINMA) with specified information and be placed on the FINMA register before providing services.
To be eligible, UK insurance firms (insurers and intermediaries) must:
To be eligible, UK insurers must:
Clients to whom a UK insurer may provide services must be incorporated in Switzerland and meet at least two of the following requirements:
1. Net turnover in excess of CHF 40 million
2. Balance sheet total in excess of CHF 20 million
3. In excess of 250 employees
4. Enhancing Banks’ and Insurers’ Approaches to Managing Climate-Related Risks
PRA Policy Statement: Enhancing Banks’ and Insurers’ Approaches to Managing Climate-Related Risks (PS25/25)
On December 3, 2025, the PRA published its final policy on banks’ and insurers’ (Firms) management of climate-related risks, following consultation in April 2025.
The final policy builds on the PRA’s 2019 expectations for Firms’ management of climate-related risks, providing greater clarity and aligning the expectations with international standards.
Key changes to the final policy (from the draft proposals):
The policy took effect upon publication.
5. Alternative Life Capital: Supporting Innovation in the Life Insurance Sector
PRA Discussion Paper on Alternative Life Capital: Supporting Innovation in the Life Insurance Sector (DP2/25)
The PRA is seeking feedback on potential policy changes that could enable life insurers to transfer defined tranches of risk to the capital markets. At this stage, no specific policy changes are proposed. Rather, the PRA is gathering stakeholder feedback on how to facilitate life insurers’ access to alternative forms of capital that do not derive from equity or debt issuance, with particular focus on identifying regulatory barriers to capital entering the sector. Feedback is sought by February 6, 2026.
The PRA indicates that it is open to a broad range of innovative structures – including potential reforms to the Insurance Special Purpose Vehicle (ISPV) framework and adaptation of mechanisms used in other markets, such as banking.
Nevertheless, the PRA has highlighted a non-exhaustive set of risk transformation examples (below) and is seeking views on their feasibility/attractiveness and associated risks: i) ISPVs; ii) significant risk transfers (SRTs); and iii) life insurance sidecars and joint ventures.
ISPVs
The PRA acknowledges that the current UK regime is targeted towards non-life and short-term risks, which may present challenges when considering its application to longer-term insurance liabilities.
SRTs
The PRA invites views on the potential adaptation of SRTs (well established in the banking sector) for use by life insurers, noting uncertainty over long-term outcomes and the degree/effectiveness of risk transfer may vary over time depending on asset performance.
Life Insurance Sidecars and Joint Ventures
The PRA notes that some alternative structures (including strategic partnerships and joint ventures) are more prevalent internationally and have been developing in the UK, and it invites views on the potential use of life insurance sidecars.
The Discussion Paper also sets out six overarching principles intended to guide the PRA’s consideration of alternative life capital.
6. FCA Simplifies Complaints Reporting Process
FCA Simplifies Complaints Reporting Process (PS25/19)
The FCA has confirmed plans to streamline the way firms report complaints. Five existing complaints returns will be replaced by a single consolidated return. The first reporting period under the new process will run from January 1, 2026 to June 30, 2027.
Insurance sector impact:
7. FCA and PRA Announce Plans to Support Growth of Mutuals Sector
Regulators Announce Plans to Support Growth of Mutuals Sector (Mutuals Landscape Report)
In December 2025, the PRA and FCA jointly published the Mutuals Landscape Report (the Report) and announced a series of measures designed to support the growth of the mutuals sector.
The Report focuses on the mutuals sector as a whole, noting the UK Government’s commitment to doubling its size and sets out plans for credit unions, building societies, and mutual insurers.
The Report notes challenges specifically for mutual insurers, including the following:
The new targeted initiatives to support mutual insurers include the following:
1. The establishment of a new FCA Mutual Societies Development Unit
This will act as a central hub to help mutuals (including insurers) navigate policy and regulatory change by offering expertise on legislation and regulatory processes.
2. Reduced barriers to entry
The FCA is to provide free preapplication support for firms wishing to form/convert to mutual societies.
The application processing window for new societies is also to be reduced from 15 to 10 working days, intended to incentivise more society registrations.
3. The launch of a joint PRA and FCA Scale-up Unit to provide regulatory support to eligible firms, including mutuals that are looking to grow rapidly.
8. FCA Simplification of the Insurance Rules
FCA Policy Statement: Simplifying the Insurance Rules (PS25/21)
The FCA has confirmed various measures that simplify regulations for firms across the insurance and funeral plans sectors and announced further changes affecting insurance firms in 2026 to support growth and innovation.
Key final rules:
Key proposed changes:
Review of core FCA Handbook definitions to promote “consistency and clarity.”
9. FCA Confirms Final Guidance to Tackle Serious Non-financial Misconduct in Financial Services
FCA Confirms Final Guidance to Tackle Serious Non-financial Misconduct in Financial Services (PS25/23)
In July 2025, the FCA updated its rules to more broadly capture non-financial misconduct (NFM) across banks and non-banks (including insurers) that are subject to the Code of Conduct (COCON) and the Fit and Proper test (FIT). In December 2025, the FCA finalised its regulatory framework on NFM and provided further guidance on how to determine when there has been a breach and how to proceed thereafter.
The FCA has introduced a new COCON rule that extends NFM to include “unwanted conduct that has the purpose or effect of violating a colleague’s dignity or creating an intimidating, hostile, degrading, humiliating or offensive environment for them.”
Not all poor behaviour satisfies the regulatory threshold. But serious NFM is considered a conduct breach and requires declaration to the FCA. It may result in enforcement action against firms and/or FIT consequences for individuals.
The rules do not require employers to monitor employee’s private lives; external conduct will be relevant only where there is risk of future regulatory breach(es) or the conduct is serious enough to erode public confidence.
The guidance will come into effect on September 1, 2026 and will not have retrospective effect.
Please see the corresponding Sidley briefing note for further information.
10. Reform of Anti-Money-Laundering and Counter-Terrorism Financing Supervision
HM Treasury Consultation Response: Reform of the Anti-Money-Laundering and Counter-Terrorism Financing Supervision Regime
In 2022, HM Treasury undertook review of the UK’s anti-money-laundering and counter-terrorism financing (AML/CTF) supervisory system. The review concluded that weaknesses in supervision may require structural reform. In summer 2023, HM Treasury then consulted on reform of the supervisory regime. As part of its consultation, HM Treasury requested feedback on four possible models for reform. In October 2025, HM Treasury published its response to this consultation.
At present, the supervisory system comprises three supervisors: the FCA; His Majesty’s Revenue & Customs (HMRC); and 22 private sector professional body supervisors (PBSs).
The UK Government has decided to proceed with model 3, the creation of a single professional services supervisory (SPSS). Under this model, the FCA will be granted responsibility for all AML/CTF supervision for the legal and accountancy sectors and trust and company service providers. As SPSS, the FCA will carry out these functions independently of HM Treasury and will in practice replace PBSs and HMRC in AML/CTF supervision.
The UK Government has confirmed that efforts are underway to introduce the necessary primary legislation and establish a transition plan but has not committed itself to a strict timetable.
A separate consultation on SPSS specific powers closed in December 2025, with a response anticipated in early 2026.
Following the 2022 review, HM Treasury has also proposed reform of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 and related legislation via the draft Money Laundering and Terrorist Financing (Amendment and Miscellaneous Provisions) Regulations 2025 (the SI). The instrument is focused on targeting amendments to close regulatory loopholes, address proportionality concerns; and account for evolving risks in relation to AML/CTF. For example, the SI provides clarity on the scope of “unusually complex or unusually large” transactions for the purposes of enhanced due diligence – confirming that this measure is relative to what is standard for the sector/nature of the transaction.
The final statutory instrument is expected to be laid out in early 2026.
11. Lloyd’s Market Bulletin: Update to the Agency Circumstances Procedure
Lloyd’s Market Bulletin: Update to the Agency Circumstances Procedure (Ref: Y5474)
Introduced in 2000, Part A of the Agency Agreements (Amendment No.20) Byelaw amended the standard managing agent’s agreement and provided that no transaction, arrangement, relationship, act or event which would or might otherwise be regarded as constituting or giving rise to a contravention of a managing agent’s fiduciary obligations shall be regarded as constituting a contravention if it occurs in circumstances, and in line with requirements, specified by the Council (the Agency Circumstances Procedure).
In December 2025, Lloyd’s confirmed amendments to the ballot requirement of the Agency Circumstances Procedure.
Previously, when a certain proportion of syndicate members objected to a specified proposal by the syndicate’s managing agent, it was required that a ballot be held of unaligned members (seeking approval of the proposal, usually following efforts by the managing agent to address concerns).
December 2025 changes:
The managing agent has discretion to offer the option to vote by email or other electronic means so long as the integrity of the voting process is maintained
12. EIOPA Issues Guidance on Group Supervision
European Insurance and Occupational Pensions Authority (EIOPA) Final Report on Guidelines on Exclusion of Undertakings From the Scope of Group Supervision
EIOPA has published guidelines on exclusions from group supervision, specifying the conditions under which group supervisors may exclude undertakings from group supervision. The Guidelines will become applicable on January 30, 2027.
Exclusions are only permissible in “exceptional circumstances” and must be duly justified to EIOPA and, where applicable, to the other supervisory authorities concerned.
Guideline 1: Supervisors should not exclude if the entity (i) has material intragroup transactions, (ii) has significant influence/coordination over group insurers, or (iii) is needed to understand group risk.
Guideline 2: Supervisors should only consider exclusion based on legal impediments to information exchange between authorities where (i) the undertaking is located in a third country with no equivalence decision; (ii) the undertaking is not party to the International Association of Insurance Supervisors Multilateral Memorandum of Understanding; and (iii) the entity is small relative to the group and its risks are already captured and managed at sole level. Before excluding, supervisors should first consider signing a memorandum of understanding with the third-country supervisor.
Guideline 3: Where exclusion would lead to non-application of group supervision for an undertaking under Article 214(2) point (B) or (C), exclusion should occur only if the entity is small relative to the group, their risks are already captured and managed at individual entity level, and (if a parent undertaking) the risks arise almost entirely from the group.
Guideline 4: Ultimate parents should only be excluded if the parent is not in any of the circumstances set out in Guideline 1; all group risks arising from all other undertakings and intra-group transactions that could affect the undertakings are fully captured at the intermediate level; and the supervisor has adequate information on parent-level group transactions.
Guideline 5: Exclusions must be reassessed and monitored – including ongoing review of intragroup transactions – to ensure conditions remain met.

Life in the Olympic Village balances high intensity competition with training, recovery and the need to reset mentally. The Intelligent Pin Trading Station is designed for athletes to enjoy…